The repo lists a few, but the main reasons are it lets you easily rekey to future encryption standards, and it supports one way encryption. Tools like SOPS req

The repo lists a few, but the main reasons are it lets you easily rekey to future encryption standards, and it supports one way encryption. Tools like SOPS require you have access to decrypt everything in order to add secrets (typically, though there are workarounds). With Rot, this works out of the box through another layer of asymmetric encryption. Here's a diagram of Rot's secrets wrapping works: https://rotx.dev/docs/explanations/secret-wrapping/ https://rotx.dev/docs/explanations/secret-wrapping/